For anyone looking for more information, this is a direct link to the findings from PenTest Partners.

https://www.pentestpartners.com/security-blog/exploiting-copilot-ai-for-sharepoint/

@paco how does this interact with Restricted Sharepoint Search?

I’d assume that this would mitigate that particular threat.

Maybe not.

https://learn.microsoft.com/en-us/sharepoint/restricted-sharepoint-search

@SecurityWriter I have no idea. I avoid windows as much as possible and have virtually never used sharepoint in the last 10 years. I just dunk on Microsoft for fun.

@paco it’s fun to dunk on Microsoft, but it doesn’t help if we perpetuate or exaggerate half truths.

RSS is standard configuration if you’re enabling copilot, so if you don’t, you’re going to come across these issues.

I was concerned that it was breaking out of these guardrails.

@SecurityWriter I posted the link to the real report. That’s as much real info as I have available. Read it. You’re not the first person to say that it might not be this as bad as it sounds. I don’t know, so that’s why I posted a link to the source.

I’d love to post a link to a clearer rebuttal. Like “sensible people would always set ABC, and if you set it that way, copilot will return XYZ in this situation instead of returning passwords.”

I don’t have the equipment or experience to reproduce it. But the pen test partners report seems to have all it takes to reproduce their results, doesn’t it?

@paco We tested it when the report first came out and haven’t been able to replicate on a properly configured tenant. That said not everyone reads the documentation and will no doubt run into these issues.

To be honest I’d rather they abandoned the accursed thing.

@SecurityWriter What would be really useful would be to have a sharepoint system that does reproduce it, then change the configuration, and show how the attempts now fail. That would be a powerful demo to put the issue in its proper context. Otherwise people are left scratching their heads wondering. If the examples don’t work on their system, is that because they’re properly configured or is it because they’re vulnerable but they’re testing it wrong?

@paco I’ve raised concerns about what would happen if we let Copilot index first and restrict Access later (say for future sites), I really don’t know what would happen as it’s undocumented.

I might give it a whirl should I get time.

@SecurityWriter @paco main thing I noticed yesterday is that Restricted Search is disabled by default. Which makes me unhappy.

@v_perjorative @paco it’s rather silly. Should be opt-in. Not opt out.

@SecurityWriter @paco yup, but entirely at odds with the entire business model of AI